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1. REAL PARTY IN INTEREST 

The present application is assigned to International Business Machines Corporation, 
having its principal place of business at New Orchard Road, Armonk, New York 10504. 
Accordingly, International Business Machines Corporation is the real party in interest. 

2. RELATED APPEALS AND INTERFERENCES 

The Appellants, assignee, and the legal representatives of both are unaware of any other 
appeal or interference which will be directly affected by or have a bearing on the Board's decision 
in this appeal. 

3. STATUS OF CLAIMS 

A. Claims canceled: None 

B. Claims withdrawn from consideration but not canceled: None 

C. Claims pending: 1-18 

D. Claims allowed: none 

E. Claims rejected: 1-18 

F. Claims appealed: 1-18 

Appealed claims 1-18 as currently pending are attached as the Claims Appendix hereto. 
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4. STATUS OF AMENDMENTS 

A Reply under 37 CFR §1.111 was filed on September 4, 2007, and claim amendments 
were made. In response, the Examiner issued the final Office Action appealed herein. 

5. SUMMARY OF THE CLAIMED SUBJECT MATTER 

Claim 1 : A method of conducting electronic commerce transactions among a plurality of 
participants in an E-marketplace, comprising the steps of: 

the E-marketplace obtaining digitally-signed privacy-use information for each participant 

(page 10, lines 3-7; Fig. 3, step 304); and 
the E-marketplace sharing the digitally-signed privacy-use information with any 

participants interested in doing business with each other in the E-marketplace 

(page 10, lines 8-17; Fig. 3, steps 306 and 308). 

Claim 7: A computer program product recorded on computer-readable medium for 
conducting electronic commerce transactions among a plurality of participants in an E- 
marketplace, comprising: 

computer-readable means for the E-marketplace obtaining digitally-signed privacy-use 

information for each participant (page 10, lines 3-7; Fig. 3, step 304); and 
computer-readable means for the E-marketplace sharing the digitally-signed privacy-use 
information with any participants interested in doing business with each other in 
the E-marketplace (page 10, lines 8-17; Fig. 3, steps 306 and 308). 
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Claim 13: A system for conducting electronic commerce transactions among a plurality of 
participants in an E-marketplace, comprising: 

means for the E-marketplace obtaining digitally-signed privacy-use information for each 

participant (page 10, lines 3-7; Fig. 3, step 304); and 
means for the E-marketplace sharing the digitally-signed privacy-use information with any 

participants interested in doing business with each other in the E-marketplace 

(page 10, lines 8-17; Fig. 3, steps 306 and 308). 

In accordance with 37 CFR 4 1 .37(c)(l)(vii), the structure, materials, or acts corresponding to 
each the means plus function clause recited in claim 13 is identified and described in the portions of 
the specification which are cited immediately following each clause of claim 13, above, as well as in 
page 12, line 6 through page 13, line2 of the specification. 

The present claimed invention teaches a method, computer program product and system 
for using a digital signature in privacy policies submitted to an E-Marketplace where electronic 
transactions are conducted. In the claimed invention, the E-marketplace obtains digitally signed 
privacy-use information (privacy policy) from each of a plurality of participants and then shares the 
digitally signed privacy information with any participants interested in doing business with each other. 
The E-marketplace is discussed on page 7, lines 2-15 of the specification and shown in Figs. 1 and 2 as 
being a distinct entity that is coupled to a plurality of participants including buyers, sellers and third 
parties through a network such as the internet. The E-marketplace receives communications from the 
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buyers, sellers and third parties; stores information for viewing by the participants; and stores 
information relating to transactions that occur in the E-marketplace. Thus, the E-marketplace is a 
separate entity from the plurality of participants in the E-marketplace. 

6. GROUNDS OF REJECTION TO BE REVIEWED ON APPEAL 

Appellants request the Board to review the following rejections: 
A. Rejection of claims 1-18 under 35 U.S.C. §102(e) as being anticipated by U.S. 
Patent Application No. 20060075122 to Lindskog et al. ("Lindskog"). 

7. ARGUMENT 

Rejection of Claims 1-18 under 35 U.S.C. §102(e) as being anticipated by Lindskog 

The Examiner Has Not Established a Prima Facie Case of Anticipation 
As set forth in the MPEP: 

AA claim is anticipated only if each and every element as set forth in the claim is 
found, either expressly or inherently described, in a single prior art reference. @ MPEP 
' 2131 citing Verdegaal Bros. v. Union Oil Company of California, 814 F.2d 628, 
631, 2 U.S.P.Q. 2d 1051, 1053 (Fed. Cir. 1987) 

The Examiner Has Not Established a prima facie Case of Anticipation 

The claims of the present invention recite that digitally-signed privacy-use information is 
obtained by an E-marketplace for each of a plurality of participants. Then, the E-marketplace shares 
the privacy information with the participants in the E-marketplace. The nature of problem solved by 
the present claimed invention is that the privacy-use information is under the control of an 
intermediary (the E-marketplace) after it is submitted by one participant and before it is shared with 
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another participant, so that a third party has an opportunity to modify privacy policy. The integrity of 
the digital signature ensures that privacy policies are not tampered with while under the control of the 
E-marketplace. By including a digital signature in a privacy policy submitted to the E-marketplace by a 
participant, other participants that subsequently receive the privacy policy from the E-marketplace can 
ensure the integrity of the privacy policy by ensuring that the digital signature has not been altered by the E- 
marketplace or any other intermediary. Such assurance prevents an unscrupulous E-marketplace 
administration from modifying a submitted privacy policy before sharing it with the other participants and 
prevents an unscrupulous vendor from later denying the terms of the policy as being valid. 

In contrast to the present invention, nowhere does Lindskog teach that a privacy policy is 
obtained by an intermediary from one entity and then shared by the intermediary with a second entity. 
Rather, the privacy policy of Lindskog is transmitted only once, from a single content provider to a 
single user agent. Lindskog teaches that a single user (through the use of a user agent that is 
associated with the user or provided in the user equipment) (page 2, paragraph [0017] of Lindskog) 
generates a receipt when the user accepts a privacy policy file that has been transmitted by the content 
provider to the user agent (Abstract of Lindskog). First, the user agent of Lindskog requests a 
resource over the internet from a content provider on behalf of a user. In response, the content 
provider transmits a privacy policy file containing information regarding the usage of cookies to the 
user agent. The user agent then transmits a cookie receipt back to the content provider specifying 
whether the user accepts the policy. As a result, the content provider is made aware of whether the 
user will permit the content provider to transmit a cookie along with the requested resource. The 
invention of Lindskog only discloses the existence of one privacy policy file (that of the content 
provider) and the privacy policy file is only transmitted one time (from the content provider to the 
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user agent). Thus, the problem of ensuring the integrity of the policy while it is under the control of 
an intermediary does not even exist in Lindskog. The invention of Lindskog does not teach that a 
privacy policy file is ever transmitted to any type of intermediary at any time and does not teach that 
any other privacy policy files other than that of the content provider are transmitted at any time. 

Response to the Examiner's Arguments 

On page 2 of the Office Action, in the section entitled Response 1, the Examiner states 
that "the PTO has not been able to find the aspect of the policy being transmitted to an 
intermediary at any time in the claims." However, each independent claim in the present 
application clearly states that the E-marketplace obtains digitally-signed privacy-use information 
for each participant and the E-marketplace shares the digitally-signed privacy-use information 
with any participants interested in doing business with each other in the E-marketplace. Thus, the 
E-marketplace acts as an intermediary between participants to transactions by obtaining digitally- 
signed privacy-use information from each entity/participant (each one of the claimed plurality of 
participants) and then sharing the digitally-signed privacy-use information with each other 
entity/participant (each one of the "any participants interested in doing business with each other in 
the E-marketplace"). 

Additionally, the Examiner proceeds to discuss an example where a computer server hosts 
a website for a company and offers services and resources. However, nowhere in the Examiner's 
example is there any mention of any entity that performs the steps of the E-marketplace in the 
present invention, i.e., obtaining digitally-signed privacy-use information for each participant and 
then sharing the digitally-signed privacy-use information with every other participant interested in 
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doing business with each other in the E-marketplace. Also, the Examiner's example does not 
appear to bear any relation to the invention of Lindskog. Thus, Applicants are unclear as to the 
relevance of the Examiner's example. 

On page 2-3 of the Office Action, in the section entitled Response 2, the Examiner first 
cites the Merriam Webster definition of the word "entity" and then incorrectly states that the 
entities per Applicant's invention are (1) web hosting (which is not mentioned anywhere in the 
claims of the present application), (2) the company selling the goods/services and (3) users. In 
actuality, the entities of Applicant's invention are the E-marketplace and any two of the 
participants in the E-marketplace who are interested in doing business with each other. The E- 
marketplace obtains a privacy policy from each participant and transmits a privacy policy to each 
participant. 

Next, in relating his arguments to Lindskog, first the Examiner correctly points out the 
single instance of the giving of a privacy policy in the invention of Lindskog (user's opportunity to 
accept or reject content provider's policy as described in paragraphs [0022] to [0024]). 
Subsequently the Examiner incorrectly states that paragraph [0017] of Lindskog discloses that a 
third party obtains a privacy policy from a seller and third party shares the policy with the user. 
What paragraph [0017] of Lindskog actually discloses is that "a user agent associated with or 
provided in the user equipment receives a privacy policy for the content provider." Thus, only 
one privacy policy is obtained from one entity in paragraph [0017] of Lindskog (the user agent 
obtaining from the content provider). Under the Examiner's cited definition of "entity", the user 
agent in Lindskog is not a different entity than the user because it is not a "separate, independent 
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existence from the user." Rather, the user agent is provided in the user equipment. Additionally, 

nowhere does the user agent in Lindskog share the content provider's privacy policy with any 

entity. And, unlike the present claimed invention which obtains digitally-signed privacy-use 

information for each participant, nowhere does the user agent in Lindskog obtain any other 

privacy policy from of any other entity than the content provider and then share that other 

obtained privacy policy with the content provider. For these reasons, Lindskog does not disclose 

or suggest the present claimed invention. 

The Examiner maintains that obtaining digitally-signed privacy-use information for each 

participant as recited by claim 1 is disclosed by the following language in Lindskog: 

User clicks on seller website for content, and a third party obtains a privacy policy 
from the seller (paragraphs [0017] and [0046] of Lindskog) - The invention deals 
with usage in a P3P agreement procedure for providing resources from content 
providers over the internet (marketplace) (paragraph [0025])" 

The Examiner further maintains that paragraphs [0017], [0018] and [0046] of Lindskog teach 

"sharing the digitally-signed privacy-use information with any participants interested in doing 

business with each other in the E-marketplace." 

It is still unclear what element of Lindskog is being asserted by the Examiner to be the 

same as the E-marketplace of the present invention. The Examiner continues to alternatively state 

that the internet in Lindskog and the user in Lindskog are the same as the E-marketplace in the 

present claimed invention. However, neither the internet nor the user agent of Lindskog are the 

same as the E-marketplace of the present invention. Rather, the E-marketplace in the present 

invention is an entity that obtains a privacy policy from one participant and the shares the policy 

with another participant and internet is simply used to transfer the information in Lindskog from 
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the content provider to the user agent and is similarly shown in Figs. 1 and 2 of the present 
application as being used to transfer information between the E-marketplace and the various 
participants in the E-marketplace. Nowhere does Lindskog disclose that the internet is a distinct 
entity which obtains privacy-use information from one entity and then shares it with another 
entity. 

Additionally, the user of Lindskog is not the same as the participant in the presently 
claimed invention with whom the privacy-use information is shared, as maintained by the 
Examiner. The user and the user agent in Lindskog are both part of the same node in the 
transmission of the privacy file. The privacy policy file is transmitted to the user agent, and the 
user agent specifies whether the user accepts the policy or not without any further transmission of 
the privacy policy file. The content provider is the only entity that transmits a privacy policy. 
Nowhere does Lindskog disclose that the user agent must explicitly share the privacy policy file 
with the user as one entity would have to share it with another entity or that privacy information is 
obtained from each participant as recited in the claims of the present invention. 

Each of the independent claims expressly recite the above elements that are neither taught 
nor suggested by Lindskog. Accordingly, each of the independent claims (Claims 1, 7 and 13), 
and all claims depending therefrom, patentably define over Lindskog and are in condition for 
allowance. 



8. CONCLUSION 
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For the foregoing reasons applicants respectfully request this Board to overrule the 



Examiner's rejections and allow Claims 1-18. 



Respectfully submitted, 



Reg. No. 42,392 
Synnestvedt & Lechner LLP 
1101 Market Street 
Suite 2600 

Philadelphia, PA 19107 
Telephone: 215-923-4466 
Facsimile: 215-923-2189 



April 25, 2008 
Date 



/Frank T. Carroll/ 



Frank T. Carroll 
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CLAIMS APPENDIX 
CLAIMS INVOLVED IN THIS APPEAL: 

1 . (Previously Presented) A method of conducting electronic commerce transactions among a 
plurality of participants in an E-marketplace, comprising the steps of: 

the E-marketplace obtaining digitally-signed privacy-use information for each participant; 
and 

the E-marketplace sharing the digitally-signed privacy-use information with any 

participants interested in doing business with each other in the E-marketplace. 

2. (Original) The method of claim 1, wherein said privacy information comprises a P3P policy. 

3. (Original) The method of claim 1, wherein said step of obtaining digitally-signed privacy-use 
information for each participant comprises at least the steps of: 

requesting each participant to submit said digitally-signed privacy-use information to the 

E-marketplace as part of a registration procedure for the E-marketplace; and 
storing all of said submitted digitally-signed privacy-use information by the E-marketplace. 

4. (Original) The method of claim 1, wherein said step of obtaining digitally- signed privacy-use 
information for each participant comprises at least the steps of: 

requiring each participant to submit said digitally-signed privacy-use information to the E- 
marketplace as part of a registration procedure for the E-marketplace; and 
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storing all of said submitted digitally-signed privacy-use information by the E-marketplace. 



5. (Original) The method of claim 4, wherein said step of sharing the digitally-signed privacy-use 
information comprises at least the step of: 

said E-marketplace making available all of said stored digitally-signed privacy-use 
information to all participants upon request. 



6. (Original) The method of claim 4, wherein said step of sharing the digitally-signed privacy-use 
information comprises at least the step of: 

said E-marketplace making available to participants in a particular transaction the stored 
digitally-signed privacy-use information of all participants in said particular 
transaction. 



7. (Previously Presented) A computer program product recorded on computer-readable medium 
for conducting electronic commerce transactions among a plurality of participants in an E- 
marketplace, comprising: 

computer-readable means for the E-marketplace obtaining digitally-signed privacy-use 

information for each participant; and 
computer-readable means for the E-marketplace sharing the digitally-signed privacy-use 
information with any participants interested in doing business with each other in 
the E-marketplace. 
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8. (Original) The program product of claim 7, wherein said privacy information comprises a P3P 
policy. 

9. (Original) The program product of claim 7, wherein said computer-readable means for 
obtaining digitally-signed privacy-use information for each participant comprises at least: 

computer-readable means for requesting each participant to submit said digitally-signed 
privacy-use information to the E-marketplace as part of a registration procedure 
for the E-marketplace; and 

computer-readable means for storing all of said submitted digitally-signed privacy-use 
information by the E-marketplace. 

10. (Original) The program product of claim 7, wherein said computer-readable means for 
obtaining digitally-signed privacy-use information for each participant comprises at least: 

computer-readable means for requiring each participant to submit said digitally-signed 
privacy-use information to the E-marketplace as part of a registration procedure 
for the E-marketplace; and 

computer-readable means for storing all of said submitted digitally-signed privacy-use 
information by the E-marketplace. 
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11. (Original) The program product of claim 10, wherein said computer-readable means for 
sharing the digitally-signed privacy-use information comprises at least: 

computer-readable means for making available by said E-marketplace all of said stored 
digitally-signed privacy-use information to all participants upon request. 

12. (Original) The program product of claim 10, wherein said computer-readable means for 
sharing the digitally-signed privacy-use information comprises at least: 

computer-readable means for making available to participants in a particular transaction, 
by said E-marketplace, the stored digitally-signed privacy-use information of all 
participants in said particular transaction. 

13. (Previously Presented) A system for conducting electronic commerce transactions among a 
plurality of participants in an E-marketplace, comprising: 

means for the E-marketplace obtaining digitally-signed privacy-use information for each 
participant; and 

means for the E-marketplace sharing the digitally-signed privacy-use information with any 
participants interested in doing business with each other in the E-marketplace. 

14. (Original) The system of claim 7, wherein said privacy information comprises a P3P policy. 



15. (Original) The system of claim 7, wherein said means for obtaining digitally-signed privacy- 
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use information for each participant comprises at least: 

computer-readable means for requesting each participant to submit said digitally-signed 

privacy-use information to the E-marketplace as part of a registration procedure 

for the E-marketplace; and 
means for storing all of said submitted digitally-signed privacy-use information by the E- 

marketplace. 



16. (Original) The system of claim 7, wherein said means for obtaining digitally-signed privacy- 
use information for each participant comprises at least: 

means for requiring each participant to submit said digitally-signed privacy-use 

information to the E-marketplace as part of a registration procedure for the E- 
marketplace; and 

means for storing all of said submitted digitally-signed privacy-use information by the E- 
marketplace. 



17. (Original) The system of claim 10, wherein said means for sharing the digitally-signed privacy- 
use information comprises at least: 

means for making available by said E-marketplace all of said stored digitally-signed 
privacy-use information to all participants upon request. 



18. (Original) The system of claim 10, wherein said means for sharing the digitally-signed privacy- 
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use information comprises at least: 

means for making available to participants in a particular transaction, by said E- 

marketplace, the stored digitally-signed privacy-use information of all participants 
in said particular transaction. 
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EVIDENCE APPENDIX 

No additional evidence is presented. 
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RELATED PROCEEDINGS APPENDIX 

No related proceedings are presented. 



